Arc Enterprise’s Raft FSM ‘applyRegisterFile’ function accepts arbitrary file paths when registering a manifest, performing only a non‑empty string check and offering no safeguard against parent‑traversal, scheme misuse, or length limits. This flaw allows an attacker who can propose a manifest to the cluster to reference any file on the node, enabling the reading from or writing to arbitrary paths on the local filesystem or over a storage scheme such as S3, thereby creating a potential path‑traversal vulnerability.

Vulnerable Arc Enterprise (Basekick‑Labs:arc) installations before version 26.06.1, which employ the Raft FSM for cluster communication and peer‑to‑peer manifest registration, are affected. The issue is present when the system is running in cluster mode; non‑clustered single‑node deployments are not impacted.

The CVSS score of 8.3 signals high severity, while the EPSS metric is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The lack of path validation combined with the cluster‑wide nature of the endpoint provides a worm primitive that can propagate once a single node is compromised, assuming an attacker can submit a malicious manifest proposal. Exploitation would enable arbitrary file reads and writes across the cluster, exposing the potential for further compromise, though the description does not explicitly state that remote code execution is guaranteed.